Documenti di Didattica
Documenti di Professioni
Documenti di Cultura
What is it?
There are many ways to represent the same numeric value. Long ago, humans used sticks
to count, and later learned how to draw pictures of sticks in the ground and eventually on
paper. So, the number 5 was first represented as: | | | | | (for five sticks).
Later on, the Romans began using different symbols for multiple numbers of sticks: | |
| still meant three sticks, but a V now meant five sticks, and an X was used to
represent ten of them!
Using sticks to count was a great idea for its time. And using symbols instead of real
sticks was much better. One of the best ways to represent a number today is by using the
modern decimal system. Why? Because it includes the major breakthrough of using a
symbol to represent the idea of counting nothing. About 1500 years ago in India, zero
(0) was first used as a number! It was later used in the Middle East as the Arabic, sifr.
And was finally introduced to the West as the Latin, zephiro. Soon you'll see just how
valuable an idea this is for all modern number systems.
Decimal System
Most people today use decimal representation to count. In the decimal system there are
10 digits:
0, 1, 2, 3, 4, 5, 6, 7, 8, 9
The value is formed by the sum of each digit, multiplied by the base (in this case it is 10
because there are 10 digits in decimal system) in power of digit position (counting from
zero):
Position of each digit is very important! for example if you place "7" to the end:
547
it will be another value:
Page 1 of 161
Important note: any number in power of zero is 1, even zero in power of zero is 1:
Binary System
Computers are not as smart as humans are (or not yet), it's easy to make an electronic
machine with two states: on and off, or 1 and 0.
Computers use binary system, binary system uses 2 digits:
0, 1
Each digit in a binary number is called a BIT, 4 bits form a NIBBLE, 8 bits form a
BYTE, two bytes form a WORD, two words form a DOUBLE WORD (rarely used):
There is a convention to add "b" in the end of a binary number, this way we can
determine that 101b is a binary number with decimal value of 5.
Page 2 of 161
Hexadecimal System
0, 1, 2, 3, 4, 5, 6, 7, 8, 9, A, B, C, D, E, F
There is a convention to add "h" in the end of a hexadecimal number, this way we can
determine that 5Fh is a hexadecimal number with decimal value of 95.
We also add "0" (zero) in the beginning of hexadecimal numbers that begin with a letter
(A..F), for example 0E120h.
Page 3 of 161
Converting from Decimal System to Any Other
In order to convert from decimal system, to any other system, it is required to divide the
decimal value by the base of the desired system, each time you should remember the
result and keep the remainder, the divide process continues until the result is zero.
Let's convert the value of 39 (base 10) to Hexadecimal System (base 16):
Page 4 of 161
The result is 0AB5Ch, we are using the above table to convert remainders over 9 to
corresponding letters.
Using the same principle we can convert to binary form (using 2 as the divider), or
convert to hexadecimal number, and then convert it to binary number using the above
table:
Signed Numbers
There is no way to say for sure whether the hexadecimal byte 0FFh is positive or
negative, it can represent both decimal value "255" and "- 1".
8 bits can be used to create 256 combinations (including zero), so we simply presume that
first 128 combinations (0..127) will represent positive numbers and next 128
combinations (128..256) will represent negative numbers.
In order to get "- 5", we should subtract 5 from the number of combinations (256), so it
we'll get: 256 - 5 = 251.
Using this complex way to represent negative numbers has some meaning, in math when
you add "- 5" to "5" you should get zero.
This is what happens when processor adds two bytes 5 and 251, the result gets over 255,
because of the overflow processor gets zero!
Page 5 of 161
When combinations 128..256 are used the high bit is always 1, so this maybe used to
determine the sign of a number.
The same principle is used for words (16 bit values), 16 bits create 65536 combinations,
first 32768 combinations (0..32767) are used to represent positive numbers, and next
32768 combinations (32767..65535) represent negative numbers.
There are some handy tools in emu8086 to convert numbers, and make calculations of
any numerical expressions, all you need is a click on Math menu:
Page 6 of 161
Base converter allows you to convert numbers from any system and to any system. Just
type a value in any text-box, and the value will be automatically converted to all other
systems. You can work both with 8 bit and 16 bit values.
Multi base calculator can be used to make calculations between numbers in different
systems and convert numbers from one system to another. Type an expression and press
enter, result will appear in chosen numbering system. You can work with values up to 32
bits. When Signed is checked evaluator assumes that all values (except decimal and
double words) should be treated as signed. Double words are always treated as signed
values, so 0FFFFFFFFh is converted to -1.
For example you want to calculate: 0FFFFh * 10h + 0FFFFh (maximum memory
location that can be accessed by 8086 CPU). If you check Signed and Word you will get
-17 (because it is evaluated as (-1) * 16 + (-1) . To make calculation with unsigned values
uncheck Signed so that the evaluation will be 65535 * 16 + 65535 and you should get
1114095.
You can also use the base converter to convert non-decimal digits to signed decimal
values, and do the calculation with decimal values (if it's easier for you).
Hexadecimal numbers must have "h" suffix, and start with a zero
when first digit is a letter (A..F), example:
0ABCDh
this tutorial is intended for those who are not familiar with assembler at all, or have a
very distant idea about it. of course if you have knowledge of some high level
programming language (java, basic, c/c++, pascal...) that may help you a lot.
but even if you are familiar with assembler, it is still a good idea to look through this
document in order to study emu8086 syntax.
it is assumed that you have some knowledge about number representation (hex/bin), if
not it is highly recommended to study numbering systems tutorial before you proceed.
assembly language is a low level programming language. you need to get some
knowledge about computer structure in order to understand anything. the simple
computer model as i see it:
Page 8 of 161
the system bus (shown in yellow) connects the various components of a computer.
The CPU is the heart of the computer, most of computations occur inside the CPU.
RAM is a place to where the programs are loaded in order to be executed.
8086 CPU has 8 general purpose registers, each register has its own name:
AX - the accumulator register (divided into AH / AL).
BX - the base address register (divided into BH / BL).
CX - the count register (divided into CH / CL).
DX - the data register (divided into DH / DL).
SI - source index register.
DI - destination index register.
BP - base pointer.
SP - stack pointer.
despite the name of a register, it's the programmer who determines the usage for each
Page 9 of 161
general purpose register. the main purpose of a register is to keep a number (variable). the
size of the above registers is 16 bit, it's something like: 0011000000111001b (in binary
form), or 12345 in decimal (human) form.
4 general purpose registers (AX, BX, CX, DX) are made of two separate 8 bit registers,
for example if AX= 0011000000111001b, then AH=00110000b and AL=00111001b.
therefore, when you modify any of the 8 bit registers 16 bit register is also updated, and
vice-versa. the same is for other 3 registers, "H" is for high and "L" is for low part.
because registers are located inside the cpu, they are much faster than memory. accessing
a memory location requires the use of a system bus, so it takes much longer. accessing
data in a register usually takes no time. therefore, you should try to keep variables in the
registers. register sets are very small and most registers have special purposes which limit
their use as variables, but they are still an excellent place to store temporary data of
calculations.
segment registers
although it is possible to store any data in the segment registers, this is never a good idea.
the segment registers have a very special purpose - pointing at accessible blocks of
memory.
segment registers work together with general purpose register to access any memory
value. For example if we would like to access memory at the physical address 12345h
(hexadecimal), we should set the DS = 1230h and SI = 0045h. This is good, since this
way we can access much more memory than with a single register that is limited to 16 bit
values.
CPU makes a calculation of physical address by multiplying the segment register by 10h
and adding general purpose register to it (1230h * 10h + 45h = 12345h):
Page 10 of 161
IP register always works together with CS segment register and it points to currently
executing instruction.
flags register is modified automatically by CPU after mathematical operations, this
allows to determine the type of the result, and to determine conditions to transfer control
to other parts of the program.
generally you cannot access these registers directly, the way you can access AX and other
general registers, but it is possible to change values of system registers using some tricks
that you will learn a little bit later.
Memory Access
to access memory we can use these four registers: BX, SI, DI, BP.
combining these registers inside [ ] symbols, we can get different memory locations.
these combinations are supported (addressing modes):
d8 - stays for 8 bit signed immediate displacement (for example: 22, 55h, -1, etc...)
d16 - stays for 16 bit signed immediate displacement (for example: 300, 5517h, -259,
etc...).
displacement can be a immediate value or offset of a variable, or even both. if there are
several values, assembler evaluates all values and calculates a single immediate value..
displacement can be inside or outside of the [ ] symbols, assembler generates the same
machine code for both ways.
generally the compiler takes care about difference between d8 and d16, and generates the
required machine code.
Page 11 of 161
by default DS segment register is used for all modes except those with BP register, for
these SS segment register is used.
there is an easy way to remember all those possible combinations using this chart:
you can form all valid combinations by taking only one item from each column or
skipping the column by not taking anything from it. as you see BX and BP never go
together. SI and DI also don't go together. here are an examples of a valid addressing
modes: [BX+5] , [BX+SI] , [DI+BX-4]
the value in segment register (CS, DS, SS, ES) is called a segment,
and the value in purpose register (BX, SI, DI, BP) is called an offset.
When DS contains value 1234h and SI contains the value 7890h it can be also recorded
as 1234:7890. The physical address will be 1234h * 10h + 7890h = 19BD0h.
if zero is added to a decimal number it is multiplied by 10, however 10h = 16, so if zero
is added to a hexadecimal value, it is multiplied by 16, for example:
7h = 7
70h = 112
for example:
byte ptr [BX] ; byte access.
or
word ptr [BX] ; word access.
assembler supports shorter prefixes as well:
sometimes compiler can calculate the data type automatically, but you may not and
Page 12 of 161
should not rely on that when one of the operands is an immediate value.
MOV instruction
REG: AX, BX, CX, DX, AH, AL, BL, BH, CH, CL, DH, DL, DI, SI, BP, SP.
REG: AX, BX, CX, DX, AH, AL, BL, BH, CH, CL, DH, DL, DI, SI, BP, SP.
the MOV instruction cannot be used to set the value of the CS and IP registers.
Page 13 of 161
ORG 100h ; this directive required for a simple 1 segment .com program.
MOV AX, 0B800h ; set AX to hexadecimal value of B800h.
MOV DS, AX ; copy value of AX to DS.
MOV CL, 'A' ; set CL to ASCII code of 'A', it is 41h.
MOV CH, 1101_1111b ; set CH to binary value.
MOV BX, 15Eh ; set BX to 15Eh.
MOV [BX], CX ; copy contents of CX to memory at B800:015E
RET ; returns to operating system.
you can copy & paste the above program to the code editor, and press [Compile and
Emulate] button (or press F5 key on your keyboard).
the emulator window should open with this program loaded, click [Single Step] button
and watch the register values.
1. select the above text using mouse, click before the text and drag it down until
everything is selected.
as you may guess, ";" is used for comments, anything after ";" symbol is ignored by
compiler.
Page 14 of 161
actually the above program writes directly to video memory, so you may see that MOV is
a very powerful instruction.
Variables
Variable is a memory location. For a programmer it is much easier to have some value be
kept in a variable named "var1" then at the address 5A73:235B, especially when you
have 10 or more variables.
name DB value
name DW value
name - can be any letter or digit combination, though it should start with a letter. It's
possible to declare unnamed variables by not specifying the name (this variable will have
an address but no name).
value - can be any numeric value in any supported numbering system (hexadecimal,
binary, or decimal), or "?" symbol for variables that are not initialized.
As you probably know from part 2 of this tutorial, MOV instruction is used to copy
values from source to destination.
Let's see another example with MOV instruction:
ORG 100h
VAR1 DB 7
var2 DW 1234h
Copy the above code to the source editor, and press F5 key to compile it and load in the
emulator. You should get something like:
Page 15 of 161
As you see this looks a lot like our example, except that variables are replaced with actual
memory locations. When compiler makes machine code, it automatically replaces all
variable names with their offsets. By default segment is loaded in DS register (when
COM files is loaded the value of DS register is set to the same value as CS register -
code segment).
In memory list first row is an offset, second row is a hexadecimal value, third row is
decimal value, and last row is an ASCII character value.
Compiler is not case sensitive, so "VAR1" and "var1" refer to the same variable.
The offset of var2 is 0109h, and full address is 0B56:0109, this variable is a WORD so
it occupies 2 BYTES. It is assumed that low byte is stored at lower address, so 34h is
located before 12h.
You can see that there are some other instructions after the RET instruction, this happens
because disassembler has no idea about where the data starts, it just processes the values
in memory and it understands them as valid 8086 instructions (we will learn them later).
You can even write the same program using DB directive only:
ORG 100h
DB 0A0h
DB 08h
DB 01h
Page 16 of 161
DB 8Bh
DB 1Eh
DB 09h
DB 01h
DB 0C3h
DB 7
DB 34h
DB 12h
Copy the above code to the source editor, and press F5 key to compile and load it in the
emulator. You should get the same disassembled code, and the same functionality!
As you may guess, the compiler just converts the program source to the set of bytes, this
set is called machine code, processor understands the machine code and executes it.
ORG 100h is a compiler directive (it tells compiler how to handle the source code). This
directive is very important when you work with variables. It tells compiler that the
executable file will be loaded at the offset of 100h (256 bytes), so compiler should
calculate the correct address for all variables when it replaces the variable names with
their offsets. Directives are never converted to any real machine code.
Why executable file is loaded at offset of 100h? Operating system keeps some data about
the program in the first 256 bytes of the CS (code segment), such as command line
parameters and etc.
Though this is true for COM files only, EXE files are loaded at offset of 0000, and
generally use special segment for variables. Maybe we'll talk more about EXE files later.
Arrays
Arrays can be seen as chains of variables. A text string is an example of a byte array, each
character is presented as an ASCII code value (0..255).
b is an exact copy of the a array, when compiler sees a string inside quotes it
automatically converts it to set of bytes. This chart shows a part of the memory where
these arrays are declared:
Page 17 of 161
You can access the value of any element in array using square brackets, for example:
MOV AL, a[3]
You can also use any of the memory index registers BX, SI, DI, BP, for example:
MOV SI, 3
MOV AL, a[SI]
If you need to declare a large array you can use DUP operator.
The syntax for DUP:
for example:
c DB 5 DUP(9)
is an alternative way of declaring:
c DB 9, 9, 9, 9, 9
Of course, you can use DW instead of DB if it's required to keep values larger then 255,
or smaller then -128. DW cannot be used to declare strings.
There is LEA (Load Effective Address) instruction and alternative OFFSET operator.
Both OFFSET and LEA can be used to get the offset address of the variable.
LEA is more powerful because it also allows you to get the address of an indexed
variables. Getting the address of the variable can be very useful in some situations, for
example when you need to pass parameters to a procedure.
Reminder:
In order to tell the compiler about data type,
these prefixes should be used:
Page 18 of 161
BYTE PTR - for byte.
WORD PTR - for word (two bytes).
For example:
BYTE PTR [BX] ; byte access.
or
WORD PTR [BX] ; word access.
assembler supports shorter prefixes as well:
sometimes compiler can calculate the data type automatically, but you may not and
should not rely on that when one of the operands is an immediate value.
ORG 100h
RET
VAR1 DB 22h
END
ORG 100h
Page 19 of 161
MOV AL, VAR1 ; check value of
VAR1 by moving it to AL.
RET
VAR1 DB 22h
END
These lines:
LEA BX, VAR1
MOV BX, OFFSET VAR1
are even compiled into the same machine code: MOV BX, num
num is a 16 bit value of the variable offset.
Please note that only these registers can be used inside square brackets (as memory
pointers): BX, SI, DI, BP!
(see previous part of the tutorial).
Constants
Constants are just like variables, but they exist only until your program is compiled
(assembled). After definition of a constant its value cannot be changed. To define
constants EQU directive is used:
For example:
k EQU 5
MOV AX, k
Page 20 of 161
The above example is functionally identical to code:
MOV AX, 5
You can view variables while your program executes by selecting "Variables" from the
"View" menu of emulator.
To view arrays you should click on a variable and set Elements property to array size. In
assembly language there are not strict data types, so any variable can be presented as an
array.
You can edit a variable's value when your program is running, simply double click it, or
select it and click Edit button.
It is possible to enter numbers in any system, hexadecimal numbers should have "h"
suffix, binary "b" suffix, octal "o" suffix, decimal numbers require no suffix. String can
be entered this way:
'hello world', 0
(this string is zero terminated).
Page 21 of 161
(the array can be array of bytes or words, it depends whether BYTE or WORD is
selected for edited variable).
Interrupts
Interrupts can be seen as a number of functions. These functions make the programming
much easier, instead of writing a code to print a character you can simply call the
interrupt and it will do everything for you. There are also interrupt functions that work
with disk drive and other hardware. We call such functions software interrupts.
Interrupts are also triggered by different hardware, these are called hardware interrupts.
Currently we are interested in software interrupts only.
To make a software interrupt there is an INT instruction, it has very simple syntax:
INT value
The following example uses INT 10h sub-function 0Eh to type a "Hello!" message. This
functions displays a character on the screen, advancing the cursor and scrolling the screen
as necessary.
Page 22 of 161
MOV AH, 0Eh ; select sub-function.
Copy & paste the above program to the source code editor, and press [Compile and
Emulate] button. Run it!
The list of all interrupts that are currently supported by the emulator.
These interrupts should be compatible will IBM PC and all generations of x86, original
Intel 8086 and AMD compatible microprocessors, however Windows XP may overwrite
some of the original interrupts.
Quick reference:
INT 10h/00h INT 10h/1003h INT 21h INT 21h/35h INT 33h/0000h
INT 10h/01h INT 11h INT 21h/01h INT 21h/39h INT 33h/0001h
INT 10h/02h INT 12h INT 21h/02h INT 21h/3Ah INT 33h/0002h
INT 10h/03h INT 13h/00h INT 21h/05h INT 21h/3Bh INT 33h/0003h
INT 10h/05h INT 13h/02h INT 21h/06h INT 21h/3Ch
INT 10h/06h INT 13h/03h INT 21h/07h INT 21h/3Dh
INT 10h/07h INT 15h/86h INT 21h/09h INT 21h/3Eh
INT 10h/08h INT 16h/00h INT 21h/0Ah INT 21h/3Fh
INT 10h/09h INT 16h/01h INT 21h/0Bh INT 21h/40h
INT 10h/0Ah INT 19h INT 21h/0Ch INT 21h/41h
Page 23 of 161
INT 21h/0Eh
INT 10h/0Ch INT 21h/42h
INT 21h/19h
INT 10h/0Dh INT 1Ah/00h INT 21h/47h
INT 21h/25h
INT 10h/0Eh INT 20h INT 21h/4Ch
INT 21h/2Ah
INT 10h/13h INT 21h/56h
INT 21h/2Ch
input:
AL = desired video mode.
example:
input:
CH = cursor start line (bits 0-4) and options (bits 5-7).
CL = bottom cursor line (bits 0-4).
input:
DH = row.
DL = column.
BH = page number (0..7).
example:
mov dh, 10
mov dl, 20
mov bh, 0
mov ah, 2
int 10h
input:
BH = page number.
return:
DH = row.
DL = column.
CH = cursor start line.
CL = cursor bottom line.
input:
AL = new page number (0..7).
the activated page is displayed.
Page 25 of 161
INT 10h / AH = 06h - scroll up window.
INT 10h / AH = 07h - scroll down window.
input:
AL = number of lines by which to scroll (00h = clear entire window).
BH = attribute used to write blank lines at bottom of window.
CH, CL = row, column of window's upper left corner.
DH, DL = row, column of window's lower right corner.
input:
BH = page number.
return:
AH = attribute.
AL = character.
input:
AL = character to display.
BH = page number.
BL = attribute.
CX = number of times to write character.
input:
AL = character to display.
BH = page number.
CX = number of times to write character.
input:
AL = pixel color
CX = column.
DX = row.
example:
input:
CX = column.
DX = row.
output:
AL = pixel color
input:
AL = character to write.
this functions displays a character on the screen, advancing the cursor and scrolling the
screen as necessary. the printing is always done to current active page.
example:
input:
AL = write mode:
bit 0: update cursor after writing;
bit 1: string contains attributes.
BH = page number.
BL = attribute if string contains only characters (bit 1 of AL is zero).
CX = number of characters in string (attributes are not counted).
DL,DH = column, row at which to start writing.
ES:BP points to string to be printed.
example:
Page 27 of 161
mov al, 1
mov bh, 0
mov bl, 0011_1011b
mov cx, msg1end - offset msg1 ; calculate message size.
mov dl, 10
mov dh, 7
push cs
pop es
mov bp, offset msg1
mov ah, 13h
int 10h
jmp msg1end
msg1 db " hello, world! "
msg1end:
input:
BL = write mode:
0: enable intensive colors.
1: enable blinking (not supported by the emulator and windows
command prompt).
BH = 0 (to avoid problems on some adapters).
example:
0 0000 black
1 0001 blue
2 0010 green
3 0011 cyan
4 0100 red
5 0101 magenta
6 0110 brown
7 0111 light gray
Page 28 of 161
8 1000 dark gray
9 1001 light blue
A 1010 light green
B 1011 light cyan
C 1100 light red
D 1101 light magenta
E 1110 yellow
F 1111 white
note:
; use this code for compatibility with dos/cmd prompt full screen mode:
mov ax, 1003h
mov bx, 0 ; disable blinking.
int 10h
return:
AX = BIOS equipment list word, actually this call returns the contents of
the word at 0040h:0010h.
Page 29 of 161
INT 12h - get memory size.
return:
AX = kilobytes of contiguous memory starting at absolute address
00000h, this call returns the contents of the word at 0040h:0013h.
INT 13h / AH = 00h - reset disk system, (currently this call doesn't do anything).
input:
return:
CF set on error.
CF clear if successful.
AH = status (0 - if successful).
AL = number of sectors transferred.
input:
Note:
return:
return:
Usually, the BIOS will try to read sector 1, head 0, track 0 from drive A:
to 0000h:7C00h. The emulator just stops the execution, to boot from
floppy drive select from the menu: 'virtual drive' -> 'boot from floppy'
Page 31 of 161
INT 1Ah / AH = 00h - get system time.
return:
notes:
there are approximately 18.20648 clock ticks per second,
and 1800B0h per 24 hours.
AL is not set by the emulator.
If no drive letter is specified and current directory is not set, then C:\emu8086\MyBuild\
path is used by default. FLOPPY_0,1,2,3 files are emulated independently from DOS
file system.
For the emulator physical drive A: is this file c:\emu8086\FLOPPY_0 (for BIOS
interrupts: INT 13h and boot).
Note: DOS file system limits the file and directory names to 8 characters, extension is
limited to 3 characters;
example of a valid file name: myfile.txt (file name = 6 chars, extension - 3 chars).
extension is written after the dot, no other dots are allowed.
INT 21h / AH=1 - read character from standard input, with echo, result is stored in AL.
if there is no character in the keyboard buffer, the function waits until any key is pressed.
example:
Page 32 of 161
mov ah, 1
int 21h
example:
mov ah, 2
mov dl, 'a'
int 21h
example:
mov ah, 5
mov dl, 'a'
int 21h
example:
mov ah, 6
mov dl, 'a'
int 21h ; output character.
mov ah, 6
mov dl, 255
int 21h ; get character from keyboard buffer (if any) or set ZF=1.
Page 33 of 161
INT 21h / AH=7 - character input without echo to AL.
if there is no character in the keyboard buffer, the function waits until any key is pressed.
example:
mov ah, 7
int 21h
INT 21h / AH=9 - output of a string at DS:DX. String must be terminated by '$'.
example:
org 100h
mov dx, offset msg
mov ah, 9
int 21h
ret
msg db "hello world $"
INT 21h / AH=0Ah - input of a string to DS:DX, fist byte is buffer size, second byte is
number of chars actually read. this function does not add '$' in the end of string. to print
using INT 21h / AH=9 you must set dollar character at the end of it and start printing
from address DS:DX + 2.
example:
org 100h
mov dx, offset buffer
mov ah, 0ah
int 21h
jmp print
buffer db 10,?, 10 dup(' ')
print:
xor bx, bx
mov bl, buffer[1]
mov buffer[bx+2], '$'
mov dx, offset buffer + 2
Page 34 of 161
mov ah, 9
int 21h
ret
the function does not allow to enter more characters than the specified buffer size.
see also int21.asm in c:\emu8086\examples
INT 21h / AH=0Ch - flush keyboard buffer and read standard input.
entry: AL = number of input function to execute after flushing buffer (can be
01h,06h,07h,08h, or 0Ah - for other values the buffer is flushed but no input is
attempted); other registers as appropriate for the selected input function.
Page 35 of 161
INT 21h / AH=2Ah - get system date;
return: CX = year (1980-2099). DH = month. DL = day. AL = day of week
(00h=Sunday)
org 100h
mov dx, offset filepath
mov ah, 39h
int 21h
ret
Page 36 of 161
Entry: DS:DX -> ASCIZ pathname of directory to be removed.
Return:
Entry: DS:DX -> ASCIZ pathname to become current directory (max 64 bytes).
Return:
entry:
CX = file attributes:
returns:
example:
Page 37 of 161
org 100h
mov ah, 3ch
mov cx, 0
mov dx, offset filename
mov ah, 3ch
int 21h
jc err
mov handle, ax
jmp k
filename db "myfile.txt", 0
handle dw ?
err:
; ....
k:
ret
Entry:
Return:
example:
org 100h
mov al, 2
mov dx, offset filename
mov ah, 3dh
int 21h
jc err
Page 38 of 161
mov handle, ax
jmp k
filename db "myfile.txt", 0
handle dw ?
err:
; ....
k:
ret
Return:
Entry:
BX = file handle.
CX = number of bytes to read.
DS:DX -> buffer for data.
Return:
Note: data is read beginning at current file position, and the file position is updated after a
successful read the returned AX may be smaller than the request in CX if a partial read
occurred.
entry:
Page 39 of 161
BX = file handle.
CX = number of bytes to write.
DS:DX -> data to write.
return:
note: if CX is zero, no data is written, and the file is truncated or extended to the current
position data is written beginning at the current file position, and the file position is
updated after a successful write the usual cause for AX < CX on return is a full disk.
Entry:
return:
Note: DOS does not erase the file's data; it merely becomes inaccessible because the FAT
chain for the file is cleared deleting a file which is currently open may lead to filesystem
corruption.
Entry:
Return:
CF clear if successful, DX:AX = new file position in bytes from start of file.
CF set on error, AX = error code.
Page 40 of 161
Notes:
for origins 1 and 2, the pointer may be positioned before the start of the file; no error is
returned in that case, but subsequent attempts to read or write the file will produce errors.
If the new position is beyond the current end of file, the file will be extended by the next
write (see AH=40h).
example:
org 100h
mov ah, 3ch
mov cx, 0
mov dx, offset filename
mov ah, 3ch
int 21h ; create file...
mov handle, ax
mov al, 0
mov bx, handle
mov cx, 0
mov dx, 7
mov ah, 42h
int 21h ; seek...
filename db "myfile.txt", 0
handle dw ?
data db " hello files! "
data_size=$-offset data
buffer db 4 dup(' ')
Page 41 of 161
INT 21h / AH= 47h - get current directory.
Entry:
Return:
Notes:
the returned path does not include a drive and the initial backslash.
INT 21h / AH=4Ch - return control to the operating system (stop program).
Entry:
Return:
CF clear if successful.
CF set on error, AX = error code.
Note: allows move between directories on same logical drive only; open files should not
be renamed!
Page 42 of 161
INT 33h / AX=0000 - mouse ininialization. any previous mouse pointer is hidden.
returns:
example:
mov ax, 0
int 33h
see also: mouse.asm in examples.
example:
mov ax, 1
int 33h
example:
mov ax, 2
int 33h
INT 33h / AX=0003 - get mouse position and status of its buttons.
returns:
mov ax, 3
int 33h
To make programming easier there are some common functions that can be included in
your program. To make your program use functions defined in other file you should use
the INCLUDE directive followed by a file name. Compiler automatically searches for
the file in the same folder where the source file is located, and if it cannot find the file
there - it searches in Inc folder.
Currently you may not be able to fully understand the contents of the emu8086.inc
(located in Inc folder), but it's OK, since you only need to understand what it can do.
To use any of the functions in emu8086.inc you should have the following line in the
beginning of your source file:
include 'emu8086.inc'
PUTC char - macro with 1 parameter, prints out an ASCII char at current cursor
position.
To use any of the above macros simply type its name somewhere in your code, and if
required parameters, for example:
include emu8086.inc
ORG 100h
Page 44 of 161
GOTOXY 10, 5
When compiler process your source code it searches the emu8086.inc file for
declarations of the macros and replaces the macro names with real code. Generally
macros are relatively small parts of code, frequent use of a macro may make your
executable too big (procedures are better for size optimization).
PTHIS - procedure to print a null terminated string at current cursor position (just
as PRINT_STRING), but receives address of string from Stack. The ZERO
TERMINATED string should be defined just after the CALL instruction. For
example:
CALL PTHIS
db 'Hello World!', 0
include 'emu8086.inc'
ORG 100h
DEFINE_SCAN_NUM
DEFINE_PRINT_STRING
DEFINE_PRINT_NUM
DEFINE_PRINT_NUM_UNS ; required
for print_num.
DEFINE_PTHIS
First compiler processes the declarations (these are just regular the macros that are
expanded to procedures). When compiler gets to CALL instruction it replaces the
procedure name with the address of the code where the procedure is declared. When
CALL instruction is executed control is transferred to procedure. This is quite useful,
since even if you call the same procedure 100 times in your code you will still have
relatively small executable size. Seems complicated, isn't it? That's ok, with the time you
will learn more, currently it's required that you understand the basic principle.
Page 46 of 161
8086 assembler tutorial for beginners (part 6)
Most Arithmetic and Logic Instructions affect the processor status register (or Flags)
As you may see there are 16 bits in this register, each bit is called a flag and can take a
value of 1 or 0.
Carry Flag (CF) - this flag is set to 1 when there is an unsigned overflow. For
example when you add bytes 255 + 1 (result is not in range 0...255). When there
is no overflow this flag is set to 0.
Zero Flag (ZF) - set to 1 when result is zero. For none zero result this flag is set
to 0.
Sign Flag (SF) - set to 1 when result is negative. When result is positive it is set
to 0. Actually this flag take the value of the most significant bit.
Overflow Flag (OF) - set to 1 when there is a signed overflow. For example,
when you add bytes 100 + 50 (result is not in range -128...127).
Parity Flag (PF) - this flag is set to 1 when there is even number of one bits in
result, and to 0 when there is odd number of one bits. Even if result is a word only
8 low bits are analyzed!
Auxiliary Flag (AF) - set to 1 when there is an unsigned overflow for low nibble
(4 bits).
Interrupt enable Flag (IF) - when this flag is set to 1 CPU reacts to interrupts
from external devices.
Direction Flag (DF) - this flag is used by some instructions to process data
chains, when this flag is set to 0 - the processing is done forward, when this flag is
set to 1 the processing is done backward.
Page 47 of 161
REG, memory
memory, REG
REG, REG
memory, immediate
REG, immediate
REG: AX, BX, CX, DX, AH, AL, BL, BH, CH, CL, DH, DL, DI, SI, BP, SP.
After operation between operands, result is always stored in first operand. CMP and
TEST instructions affect flags only and do not store a result (these instruction are used to
make decisions during program execution).
1 AND 1 = 1
1 AND 0 = 0
0 AND 1 = 0
0 AND 0 = 0
1 OR 1 = 1
1 OR 0 = 1
0 OR 1 = 1
0 OR 0 = 0
As you see we get 1 every time when at least one of the bits is 1.
XOR - Logical XOR (exclusive OR) between all bits of two operands. These
rules apply:
1 XOR 1 = 0
1 XOR 0 = 1
0 XOR 1 = 1
0 XOR 0 = 0
Page 48 of 161
As you see we get 1 every time when bits are different from each other.
REG
memory
REG: AX, BX, CX, DX, AH, AL, BL, BH, CH, CL, DH, DL, DI, SI, BP, SP.
Page 49 of 161
when operand is a byte:
AL = AX / operand
AH = remainder (modulus). .
REG
memory
REG: AX, BX, CX, DX, AH, AL, BL, BH, CH, CL, DH, DL, DI, SI, BP, SP.
NEG - Make operand negative (two's complement). Actually it reverses each bit
of operand and then adds 1 to it. For example 5 will become -5, and -2 will
become 2.
controlling the program flow is a very important thing, this is where your program can
make decisions according to certain conditions.
unconditional jumps
The basic instruction that transfers control to another point in the program is
JMP.
JMP label
Page 50 of 161
To declare a label in your program, just type its name and add ":" to the end, label
can be any character combination but it cannot start with a number, for example
here are 3 legal label definitions:
label1:
label2:
a:
Label can be declared on a separate line or before any other instruction, for
example:
x1:
MOV AX, 1
org 100h
calc:
add ax, bx ; add bx to ax.
jmp back ; go 'back'.
stop:
Of course there is an easier way to calculate the some of two numbers, but it's still
a good example of JMP instruction.
As you can see from this example JMP is able to transfer control both forward
and backward. It can jump anywhere in current code segment (65,535 bytes).
Unlike JMP instruction that does an unconditional jump, there are instructions
Page 51 of 161
that do a conditional jumps (jump only when some conditions are in act). These
instructions are divided in three groups, first group just test single flag, second
compares numbers as signed, and third compares numbers as unsigned.
Opposite
Instruction Description Condition
Instruction
as you may already notice there are some instructions that do that same thing,
that's correct, they even are assembled into the same machine code, so it's good to
remember that when you compile JE instruction - you will get it disassembled as:
JZ, JC is assembled the same as JB etc...
different names are used to make programs easier to understand, to code and most
importantly to remember. very offset dissembler has no clue what the original
instruction was look like that's why it uses the most common name.
if you emulate this code you will see that all instructions are assembled into JNB,
the operational code (opcode) for this instruction is 73h this instruction has fixed
length of two bytes, the second byte is number of bytes to add to the IP register if
the condition is true. because the instruction has only 1 byte to keep the offset it is
limited to pass control to -128 bytes back or 127 bytes forward, this value is
always signed.
jnc a
jnb a
Page 52 of 161
jae a
mov ax, 4
a: mov ax, 5
ret
ZF = 1
Jump if Less or Equal (<=).
JLE , JNG or JNLE, JG
Jump if Not Greater (not >).
SF <> OF
Page 53 of 161
Jump if Above (>). CF = 0
JA , JNBE Jump if Not Below or Equal and JNA, JBE
(not <=). ZF = 0
CF = 1
Jump if Below or Equal (<=).
JBE , JNA or JNBE, JA
Jump if Not Above (not >).
ZF = 1
Another example:
it's required to compare 7 and 7,
7-7=0
the result is zero! (Zero Flag is set to 1 and JZ or JE will do the jump).
include "emu8086.inc"
org 100h
mov al, 25 ; set al to 25.
mov bl, 10 ; set bl to 10.
cmp al, bl ; compare al - bl.
je equal ; jump if al = bl (zf = 1).
putc 'n' ; if it gets here, then al <> bl,
jmp stop ; so print 'n', and jump to stop.
Page 54 of 161
equal: ; if gets here,
putc 'y' ; then al = bl, so print 'y'.
stop:
ret ; gets here no matter what.
try the above example with different numbers for AL and BL, open flags by
clicking on flags button, use single step and see what happens. you can use F5
hotkey to recompile and reload the program into the emulator.
loops
opposite
instruction operation and jump condition
instruction
DEC CX and
LOOP decrease cx, jump to label if cx not zero.
JCXZ
OR CX, CX and
JCXZ jump to label if cx is zero.
JNZ
loops are basically the same jumps, it is possible to code loops without using the
loop instruction, by just using conditional jumps and compare, and this is just
what loop does. all loop instructions use CX register to count steps, as you know
CX register has 16 bits and the maximum value it can hold is 65535 or FFFF,
however with some agility it is possible to put one loop into another, and another
into another two, and three and etc... and receive a nice value of 65535 * 65535 *
65535 ....till infinity.... or the end of ram or stack memory. it is possible store
original value of cx register using push cx instruction and return it to original
when the internal loop ends with pop cx, for example:
Page 55 of 161
org 100h
mov bx, 0 ; total step counter.
mov cx, 5
k1: add bx, 1
mov al, '1'
mov ah, 0eh
int 10h
push cx
mov cx, 5
k2: add bx, 1
mov al, '2'
mov ah, 0eh
int 10h
push cx
mov cx, 5
k3: add bx, 1
mov al, '3'
mov ah, 0eh
int 10h
loop k3 ; internal in internal loop.
pop cx
loop k2 ; internal loop.
pop cx
loop k1 ; external loop.
ret
bx counts total number of steps, by default emulator shows values in hexadecimal,
you can double click the register to see the value in all available bases.
just like all other conditional jumps loops have an opposite companion that can
help to create workarounds, when the address of desired location is too far
assemble automatically assembles reverse and long jump instruction, making total
of 5 bytes instead of just 2, it can be seen in disassembler as well.
for more detailed description and examples refer to complete 8086 instruction
set
All conditional jumps have one big limitation, unlike JMP instruction they can
only jump 127 bytes forward and 128 bytes backward (note that most instructions
are assembled into 3 or more bytes).
label_x: - can be any valid label name, but there must not be two or more labels
with the same name.
here's an example:
include "emu8086.inc"
org 100h
mov al, 5
mov bl, 5
add bl, al
sub al, 10
xor al, bl
jmp skip_data
db 256 dup(0) ; 256 bytes
skip_data:
stop:
ret
Page 57 of 161
note: the latest version of emu8086 automatically creates a workaround by replacing
the conditional jump with the opposite, and adding unconditional jump. you can see
in disassembly that instead of one jump instruction there are 2. in fact, reverse
condition just decides if to make big jump or not, if it does it goes to big jump
instruction, if it does it skips it. label is just an address mark, it is used by assembler
to make the correct jump, but by itself it is not assembled in any code. to check if
you have the latest version of emu8086 click help->check for an update.
Another, yet rarely used method is providing an immediate value instead of label. When
immediate value starts with $ relative jump is performed, otherwise compiler calculates
instruction that jumps directly to given offset. For example:
org 100h
ret
Procedures
Procedure is a part of code that can be called from your program in order to make some
specific task. Procedures make program more structural and easier to understand.
Generally procedure returns to the same point from where it was called.
Page 58 of 161
name PROC
RET
name ENDP
name - is the procedure name, the same name should be in the top and the bottom, this is
used to check correct closing of procedures.
Probably, you already know that RET instruction is used to return to operating system.
The same instruction is used to return from procedure (actually operating system sees
your program as a special procedure).
PROC and ENDP are compiler directives, so they are not assembled into any real
machine code. Compiler just remembers the address of procedure.
Here is an example:
ORG 100h
CALL m1
MOV AX, 2
m1 PROC
MOV BX, 5
RET ; return to caller.
m1 ENDP
END
The above example calls procedure m1, does MOV BX, 5, and returns to the next
instruction after CALL: MOV AX, 2.
There are several ways to pass parameters to procedure, the easiest way to pass
parameters is by using registers, here is another example of a procedure that receives two
parameters in AL and BL registers, multiplies these parameters and returns the result in
AX register:
Page 59 of 161
ORG 100h
MOV AL, 1
MOV BL, 2
CALL m2
CALL m2
CALL m2
CALL m2
m2 PROC
MUL BL ; AX = AL * BL.
RET ; return to caller.
m2 ENDP
END
In the above example value of AL register is update every time the procedure is called,
BL register stays unchanged, so this algorithm calculates 2 in power of 4,
so final result in AX register is 16 (or 10h).
ORG 100h
CALL print_me
;
==========================================================
; this procedure prints a string, the string should be null
; terminated (have zero in the end),
; the string address should be in SI register:
print_me PROC
Page 60 of 161
next_char:
CMP b.[SI], 0 ; check for zero to stop
JE stop ;
stop:
RET ; return to caller.
print_me ENDP
;
==========================================================
END
"b." - prefix before [SI] means that we need to compare bytes, not words. When you need
to compare words add "w." prefix instead. When one of the compared operands is a
register it's not required because compiler knows the size of each register.
The Stack
Stack is an area of memory for keeping temporary data. Stack is used by CALL
instruction to keep return address for procedure, RET instruction gets this value from the
stack and returns to that offset. Quite the same thing happens when INT instruction calls
an interrupt, it stores in stack flag register, code segment and offset. IRET instruction is
used to return from interrupt call.
Page 61 of 161
PUSH REG
PUSH SREG
PUSH memory
PUSH immediate
POP REG
POP SREG
POP memory
Notes:
Page 62 of 161
It is very important to do equal number of PUSHs and POPs, otherwise the stack maybe
corrupted and it will be impossible to return to operating system. As you already know
we use RET instruction to return to operating system, so when program starts there is a
return address in stack (generally it's 0000h).
PUSH and POP instruction are especially useful because we don't have too much
registers to operate with, so here is a trick:
Here is an example:
ORG 100h
RET
END
Page 63 of 161
Another use of the stack is for exchanging the values,
here is an example:
ORG 100h
RET
END
The exchange happens because stack uses LIFO (Last In First Out) algorithm, so when
we push 1212h and then 3434h, on pop we will first get 3434h and only after it 1212h.
The stack memory area is set by SS (Stack Segment) register, and SP (Stack Pointer)
register. Generally operating system sets values of these registers on program start.
Add 2 to SP register.
The current address pointed by SS:SP is called the top of the stack.
For COM files stack segment is generally the code segment, and stack pointer is set to
Page 64 of 161
value of 0FFFEh. At the address SS:0FFFEh stored a return address for RET
instruction that is executed in the end of the program.
You can visually see the stack operation by clicking on [Stack] button on emulator
window. The top of the stack is marked with "<" sign.
Macros
Macros are just like procedures, but not really. Macros look like procedures, but they
exist only until your code is compiled, after compilation all macros are replaced with real
instructions. If you declared a macro and never used it in your code, compiler will simply
ignore it. emu8086.inc is a good example of how macros can be used, this file contains
several macros to make coding easier for you.
Macro definition:
<instructions>
ENDM
Unlike procedures, macros should be defined above the code that uses it, for example:
MOV AX, p1
MOV BX, p2
MOV CX, p3
ENDM
ORG 100h
MyMacro 1, 2, 3
MyMacro 4, 5, DX
RET
CALL MyProc
When you want to use a macro, you can just type its name. For example:
MyMacro
Procedure is located at some specific address in memory, and if you use the same
procedure 100 times, the CPU will transfer control to this part of the memory. The
control will be returned back to the program by RET instruction. The stack is used
to keep the return address. The CALL instruction takes about 3 bytes, so the size
of the output executable file grows very insignificantly, no matter how many time
the procedure is used.
Macro is expanded directly in program's code. So if you use the same macro 100
times, the compiler expands the macro 100 times, making the output executable
file larger and larger, each time all instructions of a macro are inserted.
You should use stack or any general purpose registers to pass parameters to
procedure.
To pass parameters to macro, you can just type them after the macro name. For
example:
MyMacro 1, 2, 3
To mark the end of the procedure, you should type the name of the procedure
before the ENDP directive.
Macros are expanded directly in code, therefore if there are labels inside the macro
definition you may get "Duplicate declaration" error when macro is used for twice or
more. To avoid such problem, use LOCAL directive followed by names of variables,
labels or procedure names. For example:
Page 66 of 161
MyMacro2 MACRO
LOCAL label1, label2
CMP AX, 2
JE label1
CMP AX, 3
JE label2
label1:
INC AX
label2:
ADD AX, 2
ENDM
ORG 100h
MyMacro2
MyMacro2
RET
If you plan to use your macros in several programs, it may be a good idea to place all
macros in a separate file. Place that file in Inc folder and use INCLUDE file-name
directive to use macros. See Library of common functions - emu8086.inc for an
example of such file.
To make programming easier there are some common functions that can be included in
your program. To make your program use functions defined in other file you should use
the INCLUDE directive followed by a file name. Compiler automatically searches for
the file in the same folder where the source file is located, and if it cannot find the file
there - it searches in Inc folder.
Currently you may not be able to fully understand the contents of the emu8086.inc
(located in Inc folder), but it's OK, since you only need to understand what it can do.
To use any of the functions in emu8086.inc you should have the following line in the
beginning of your source file:
include 'emu8086.inc'
Page 67 of 161
emu8086.inc defines the following macros:
PUTC char - macro with 1 parameter, prints out an ASCII char at current cursor
position.
To use any of the above macros simply type its name somewhere in your code, and if
required parameters, for example:
include emu8086.inc
ORG 100h
GOTOXY 10, 5
When compiler process your source code it searches the emu8086.inc file for
declarations of the macros and replaces the macro names with real code. Generally
macros are relatively small parts of code, frequent use of a macro may make your
executable too big (procedures are better for size optimization).
PTHIS - procedure to print a null terminated string at current cursor position (just
as PRINT_STRING), but receives address of string from Stack. The ZERO
Page 68 of 161
TERMINATED string should be defined just after the CALL instruction. For
example:
CALL PTHIS
db 'Hello World!', 0
To use any of the above procedures you should first declare the function in the bottom of
your file (but before the END directive), and then use CALL instruction followed by a
procedure name. For example:
include 'emu8086.inc'
ORG 100h
Page 69 of 161
msg1 DB 'Enter the number: ', 0
DEFINE_SCAN_NUM
DEFINE_PRINT_STRING
DEFINE_PRINT_NUM
DEFINE_PRINT_NUM_UNS ; required
for print_num.
DEFINE_PTHIS
First compiler processes the declarations (these are just regular the macros that are
expanded to procedures). When compiler gets to CALL instruction it replaces the
procedure name with the address of the code where the procedure is declared. When
CALL instruction is executed control is transferred to procedure. This is quite useful,
since even if you call the same procedure 100 times in your code you will still have
relatively small executable size. Seems complicated, isn't it? That's ok, with the time you
will learn more, currently it's required that you understand the basic principle.
Usually, when a computer starts it will try to load the first 512-byte sector (that's Cylinder
0, Head 0, Sector 1) from any diskette in your A: drive to memory location 0000h:7C00h
and give it control. If this fails, the BIOS tries to use the MBR of the first hard drive
instead.
This tutorial covers booting up from a floppy drive, the same principles are used to boot
from a hard drive. But using a floppy drive has several advantages:
you can keep your existing operating system intact (windows, dos, linux, unix, be-
os...).
Page 70 of 161
; Boot record is loaded at 0000:7C00,
; so inform compiler to make required
; corrections:
ORG 7C00h
copy the above example to the source editor and press emulate. the emulator
automatically loads .bin file to 0000h:7C00h (it uses supplementary .binf file to know
where to load).
you can run it just like a regular program, or you can use the virtual drive menu to write
512 bytes at 7c00h to boot sector of a virtual floppy drive (it's "FLOPPY_0" file in
Page 71 of 161
Emulator's folder). after your program is written to the virtual floppy drive, you can
select boot from floppy from virtual drive menu.
.bin files for boot records are limited to 512 bytes (sector size). if your new operating
system is going to grow over this size, you will need to use a boot program to load data
from other sectors (just like micro-os_loader.asm does). an example of a tiny operating
system can be found in c:\emu8086\examples:
micro-os_loader.asm
micro-os_kernel.asm
To create extensions for your operating system (over 512 bytes), you can use additional
sectors of a floppy disk. It's recommended to use ".bin" files for this purpose (to create
".bin" file select "BIN Template" from "File" -> "New" menu).
To write ".bin" file to virtual floppy, select "Write .bin file to floppy..." from "Virtual
drive" menu of emulator, you should write it anywhere but the boot sector (which is
Cylinder: 0, Head: 0, Sector: 1).
Page 72 of 161
you can use this utility to write .bin files to virtual floppy disk ("FLOPPY_0" file),
instead of "write 512 bytes at 7c00h to boot sector" menu. however, you should
remember that .bin file that is designed to be a boot record should always be written to
cylinder: 0, head: 0, sector: 1
Page 73 of 161
Boot Sector Location:
Cylinder: 0
Head: 0
Sector: 1
to write .bin files to real floppy disk use writebin.asm, just compile it to com file and run
it from command prompt. to write a boot record type: writebin loader.bin ; to write
kernel module type: writebin kernel.bin /k
/k - parameter tells the program to write the file at sector 2 instead of sector 1. it does not
matter in what order you write the files onto floppy drive, but it does matter where you
write them.
mote: this boot record is not MS-DOS/Windows compatible boot sector, it's not even
Linux or Unix compatible, operating system may not allow you to read or write files on
this diskette until you re-format it, therefore make sure the diskette you use doesn't
contain any important information. however you can write and read anything to and from
this disk using low level disk access interrupts, it's even possible to protect valuable
information from the others this way; even if someone gets the disk he will probably
think that it's empty and will reformat it because it's the default option in windows
operating system... such a good type of self destructing data carrier :)
Page 74 of 161
floppy disk has 2 sides, and there are 2 heads; one for each side (0..1), the drive
heads move above the surface of the disk on each side.
note: the MS-DOS (windows) formatted floppy disk has slightly less free space on it (by
about 16,896 bytes) because the operating system needs place to store file names and
directory structure (often called FAT or file system allocation table). more file names -
less disk space. the most efficient way to store files is to write them directly to sectors
instead of using file system, and in some cases it is also the most reliable way, if you
know how to use it.
The list of all interrupts that are currently supported by the emulator.
These interrupts should be compatible will IBM PC and all generations of x86, original
Intel 8086 and AMD compatible microprocessors, however Windows XP may overwrite
some of the original interrupts.
Quick reference:
INT 21h
INT 10h/00h INT 21h/35h
INT 21h/01h
INT 10h/01h INT 10h/1003h INT 21h/39h
INT 21h/02h
INT 10h/02h INT 11h INT 21h/3Ah
INT 21h/05h
INT 10h/03h INT 12h INT 21h/3Bh
INT 21h/06h
INT 10h/05h INT 13h/00h INT 21h/3Ch
INT 21h/07h
INT 10h/06h INT 13h/02h INT 21h/3Dh INT 33h/0000h
INT 21h/09h
INT 10h/07h INT 13h/03h INT 21h/3Eh INT 33h/0001h
INT 21h/0Ah
INT 10h/08h INT 15h/86h INT 21h/3Fh INT 33h/0002h
INT 21h/0Bh
INT 10h/09h INT 16h/00h INT 21h/40h INT 33h/0003h
INT 21h/0Ch
INT 10h/0Ah INT 16h/01h INT 21h/41h
INT 21h/0Eh
INT 10h/0Ch INT 19h INT 21h/42h
INT 21h/19h
INT 10h/0Dh INT 1Ah/00h INT 21h/47h
INT 21h/25h
INT 10h/0Eh INT 20h INT 21h/4Ch
INT 21h/2Ah
INT 10h/13h INT 21h/56h
INT 21h/2Ch
Page 75 of 161
input:
AL = desired video mode.
example:
input:
CH = cursor start line (bits 0-4) and options (bits 5-7).
CL = bottom cursor line (bits 0-4).
example:
mov dh, 10
mov dl, 20
mov bh, 0
mov ah, 2
int 10h
input:
BH = page number.
return:
DH = row.
DL = column.
CH = cursor start line.
CL = cursor bottom line.
input:
AL = new page number (0..7).
the activated page is displayed.
input:
AL = number of lines by which to scroll (00h = clear entire window).
BH = attribute used to write blank lines at bottom of window.
CH, CL = row, column of window's upper left corner.
DH, DL = row, column of window's lower right corner.
input:
BH = page number.
return:
Page 77 of 161
AH = attribute.
AL = character.
input:
AL = character to display.
BH = page number.
BL = attribute.
CX = number of times to write character.
input:
AL = character to display.
BH = page number.
CX = number of times to write character.
input:
AL = pixel color
CX = column.
DX = row.
example:
input:
CX = column.
DX = row.
output:
AL = pixel color
Page 78 of 161
INT 10h / AH = 0Eh - teletype output.
input:
AL = character to write.
this functions displays a character on the screen, advancing the cursor and scrolling the
screen as necessary. the printing is always done to current active page.
example:
input:
AL = write mode:
bit 0: update cursor after writing;
bit 1: string contains attributes.
BH = page number.
BL = attribute if string contains only characters (bit 1 of AL is zero).
CX = number of characters in string (attributes are not counted).
DL,DH = column, row at which to start writing.
ES:BP points to string to be printed.
example:
mov al, 1
mov bh, 0
mov bl, 0011_1011b
mov cx, msg1end - offset msg1 ; calculate message size.
mov dl, 10
mov dh, 7
push cs
pop es
mov bp, offset msg1
mov ah, 13h
int 10h
jmp msg1end
msg1 db " hello, world! "
msg1end:
Page 79 of 161
INT 10h / AX = 1003h - toggle intensity/blinking.
input:
BL = write mode:
0: enable intensive colors.
1: enable blinking (not supported by the emulator and windows
command prompt).
BH = 0 (to avoid problems on some adapters).
example:
0 0000 black
1 0001 blue
2 0010 green
3 0011 cyan
4 0100 red
5 0101 magenta
6 0110 brown
7 0111 light gray
8 1000 dark gray
9 1001 light blue
A 1010 light green
B 1011 light cyan
C 1100 light red
D 1101 light magenta
E 1110 yellow
F 1111 white
note:
; use this code for compatibility with dos/cmd prompt full screen mode:
mov ax, 1003h
mov bx, 0 ; disable blinking.
int 10h
Page 80 of 161
INT 11h - get BIOS equipment list.
return:
AX = BIOS equipment list word, actually this call returns the contents of
the word at 0040h:0010h.
return:
AX = kilobytes of contiguous memory starting at absolute address
00000h, this call returns the contents of the word at 0040h:0013h.
INT 13h / AH = 00h - reset disk system, (currently this call doesn't do anything).
Page 81 of 161
INT 13h / AH = 02h - read disk sectors into memory.
INT 13h / AH = 03h - write disk sectors.
input:
return:
CF set on error.
CF clear if successful.
AH = status (0 - if successful).
AL = number of sectors transferred.
input:
return:
Note:
Page 82 of 161
INT 16h / AH = 00h - get keystroke from keyboard (no echo).
return:
return:
Usually, the BIOS will try to read sector 1, head 0, track 0 from drive A:
to 0000h:7C00h. The emulator just stops the execution, to boot from
floppy drive select from the menu: 'virtual drive' -> 'boot from floppy'
return:
notes:
there are approximately 18.20648 clock ticks per second,
Page 83 of 161
and 1800B0h per 24 hours.
AL is not set by the emulator.
If no drive letter is specified and current directory is not set, then C:\emu8086\MyBuild\
path is used by default. FLOPPY_0,1,2,3 files are emulated independently from DOS
file system.
For the emulator physical drive A: is this file c:\emu8086\FLOPPY_0 (for BIOS
interrupts: INT 13h and boot).
Note: DOS file system limits the file and directory names to 8 characters, extension is
limited to 3 characters;
example of a valid file name: myfile.txt (file name = 6 chars, extension - 3 chars).
extension is written after the dot, no other dots are allowed.
INT 21h / AH=1 - read character from standard input, with echo, result is stored in AL.
if there is no character in the keyboard buffer, the function waits until any key is pressed.
example:
mov ah, 1
int 21h
example:
mov ah, 2
Page 84 of 161
mov dl, 'a'
int 21h
example:
mov ah, 5
mov dl, 'a'
int 21h
example:
mov ah, 6
mov dl, 'a'
int 21h ; output character.
mov ah, 6
mov dl, 255
int 21h ; get character from keyboard buffer (if any) or set ZF=1.
example:
mov ah, 7
int 21h
Page 85 of 161
INT 21h / AH=9 - output of a string at DS:DX. String must be terminated by '$'.
example:
org 100h
mov dx, offset msg
mov ah, 9
int 21h
ret
msg db "hello world $"
INT 21h / AH=0Ah - input of a string to DS:DX, fist byte is buffer size, second byte is
number of chars actually read. this function does not add '$' in the end of string. to print
using INT 21h / AH=9 you must set dollar character at the end of it and start printing
from address DS:DX + 2.
example:
org 100h
mov dx, offset buffer
mov ah, 0ah
int 21h
jmp print
buffer db 10,?, 10 dup(' ')
print:
xor bx, bx
mov bl, buffer[1]
mov buffer[bx+2], '$'
mov dx, offset buffer + 2
mov ah, 9
int 21h
ret
the function does not allow to enter more characters than the specified buffer size.
see also int21.asm in c:\emu8086\examples
Page 86 of 161
INT 21h / AH=0Ch - flush keyboard buffer and read standard input.
entry: AL = number of input function to execute after flushing buffer (can be
01h,06h,07h,08h, or 0Ah - for other values the buffer is flushed but no input is
attempted); other registers as appropriate for the selected input function.
org 100h
mov dx, offset filepath
mov ah, 39h
int 21h
ret
Return:
Page 88 of 161
INT 21h / AH= 3Bh - set current directory.
Entry: DS:DX -> ASCIZ pathname to become current directory (max 64 bytes).
Return:
entry:
CX = file attributes:
returns:
example:
org 100h
mov ah, 3ch
mov cx, 0
mov dx, offset filename
mov ah, 3ch
int 21h
jc err
mov handle, ax
jmp k
filename db "myfile.txt", 0
handle dw ?
err:
Page 89 of 161
; ....
k:
ret
Entry:
Return:
example:
org 100h
mov al, 2
mov dx, offset filename
mov ah, 3dh
int 21h
jc err
mov handle, ax
jmp k
filename db "myfile.txt", 0
handle dw ?
err:
; ....
k:
ret
Page 90 of 161
INT 21h / AH= 3Eh - close file.
Return:
Entry:
BX = file handle.
CX = number of bytes to read.
DS:DX -> buffer for data.
Return:
Note: data is read beginning at current file position, and the file position is updated after a
successful read the returned AX may be smaller than the request in CX if a partial read
occurred.
entry:
BX = file handle.
CX = number of bytes to write.
DS:DX -> data to write.
return:
note: if CX is zero, no data is written, and the file is truncated or extended to the current
position data is written beginning at the current file position, and the file position is
Page 91 of 161
updated after a successful write the usual cause for AX < CX on return is a full disk.
Entry:
return:
Note: DOS does not erase the file's data; it merely becomes inaccessible because the FAT
chain for the file is cleared deleting a file which is currently open may lead to filesystem
corruption.
Entry:
Return:
CF clear if successful, DX:AX = new file position in bytes from start of file.
CF set on error, AX = error code.
Notes:
for origins 1 and 2, the pointer may be positioned before the start of the file; no error is
returned in that case, but subsequent attempts to read or write the file will produce errors.
If the new position is beyond the current end of file, the file will be extended by the next
write (see AH=40h).
example:
org 100h
mov ah, 3ch
mov cx, 0
Page 92 of 161
mov dx, offset filename
mov ah, 3ch
int 21h ; create file...
mov handle, ax
mov al, 0
mov bx, handle
mov cx, 0
mov dx, 7
mov ah, 42h
int 21h ; seek...
filename db "myfile.txt", 0
handle dw ?
data db " hello files! "
data_size=$-offset data
buffer db 4 dup(' ')
Entry:
Return:
the returned path does not include a drive and the initial backslash.
INT 21h / AH=4Ch - return control to the operating system (stop program).
Entry:
Return:
CF clear if successful.
CF set on error, AX = error code.
Note: allows move between directories on same logical drive only; open files should not
be renamed!
INT 33h / AX=0000 - mouse ininialization. any previous mouse pointer is hidden.
returns:
example:
mov ax, 0
int 33h
Page 94 of 161
see also: mouse.asm in examples.
example:
mov ax, 1
int 33h
example:
mov ax, 2
int 33h
INT 33h / AX=0003 - get mouse position and status of its buttons.
returns:
example:
mov ax, 3
int 33h
There are 7 devices attached to the emulator: traffic lights, stepper-motor, LED display,
thermometer, printer, robot and simple test device. You can view devices when you click
"Virtual Devices" menu of the emulator.
In general, it is possible to use any x86 family CPU to control all kind of devices, the
difference maybe in base I/O port number, this can be altered using some tricky
electronic equipment. Usually the ".bin" file is written into the Read Only Memory
(ROM) chip, the system reads program from that chip, loads it in RAM module and runs
the program. This principle is used for many modern devices such as micro-wave ovens
and etc...
Traffic Lights
Usually to control the traffic lights an array (table) of values is used. In certain periods of
time the value is read from the array and sent to a port. For example:
#start=Traffic_Lights.exe#
name "traffic"
next:
mov ax, [si]
out 4, ax
; FEDC_BA98_7654_3210
situation dw 0000_0011_0000_1100b
s1 dw 0000_0110_1001_1010b
s2 dw 0000_1000_0110_0001b
s3 dw 0000_1000_0110_0001b
s4 dw 0000_0100_1101_0011b
sit_end = $
Stepper-Motor
Page 97 of 161
The motor can be half stepped by turning on pair of magnets, followed by a single and so
on.
The motor can be full stepped by turning on pair of magnets, followed by another pair of
magnets and in the end followed by a single magnet and so on. The best way to make full
step is to make two half steps.
Robot
Page 98 of 161
Complete list of robot instruction set is given in I/O ports section of emu8086 reference.
To control the robot a complex algorithm should be used to achieve maximum efficiency.
The simplest, yet very inefficient, is random moving algorithm, open robot.asm from
c:\emu8086\examples
It is also possible to use a data table (just like for Traffic Lights), this can be good if robot
always works in the same surroundings.
The latest version of the emulator has no reserved or fixed I/O ports,
input / output addresses for custom devices are from 0000 to 0FFFFh
(0 to 65535), but it is important that two devices that use the same
ports do not run simultaneously to avoid hardware conflict.
only 12 low bits of a word are used (0 to 11), last bits (12 to 15)
are unused.
for example:
IN AX, 4
If required you can read the data from port using IN instruction,
for example:
IN AL, 7
Stepper motor sets topmost bit of byte value in port 7 when it's
ready.
The first byte (port 9) is a command register. set values to this port
to make robot do something. supported values:
decimal binary
action
value value
0 00000000 do nothing.
The second byte (port 10) is a data register. this register is set
after robot completes the examine command:
0 00000000 nothing
The third byte (port 11) is a status register. read values from
this port to determine the state of the robot. each bit has a
specific property:
bit
description
number
zero when there is no new data in data register, one when there is new
bit #0
data in data register.
zero when robot is ready for next command, one when robot is busy
bit #1
doing some task.
zero when there is no error on last command execution, one when there
bit #2 is an error on command execution (when robot cannot complete the
task: move, turn, examine, switch on/off lamp).
example:
MOV AL, 1 ; move forward.
OUT 9, AL ;
MOV AL, 3 ; turn right.
OUT 9, AL ;
MOV AL, 1 ; move forward.
OUT 9, AL ;
MOV AL, 2 ; turn left.
OUT 9, AL ;
MOV AL, 1 ; move forward.
OUT 9, AL ;
keep in mind that robot is a mechanical creature and it takes
some time for it to complete a task. you should always check
bit#1 of status register before sending data to port 9,
Creating Custom Robo-World Map
It is possible to change the default map for the robot using the
tool box.
if you click the robot button and place robot over existing robot it
will turn 90 degrees counter-clock-wise. to manually move the
robot just place it anywhere else on the map.
If you click lamp button and click switched-on lamp the lamp will
be switched-off, if lamp is already switched-off it will be deleted.
click over empty space will create a new switched-on lamp.
The right-click over the map brings up a popup menu that allows
to switch-on or switch-off all the lamps at once.
Quick reference:
Operand types:
REG: AX, BX, CX, DX, AH, AL, BL, BH, CH, CL, DH, DL, DI, SI, BP, SP.
Notes:
When two operands are required for an instruction they are separated by comma.
For example:
REG, memory
When there are two operands, both operands must have the same size (except shift
and rotate instructions). For example:
AL, DL
DX, AX
m1 DB ?
AL, m1
m2 DW ?
AX, m2
Some instructions allow several operand combinations. For example:
memory, immediate
REG, immediate
memory, REG
REG, SREG
Some instructions generate exactly the same machine code, so disassembler may
have a problem decoding to your original code. This is especially important for
Conditional Jump instructions (see "Program Flow Control" in Tutorials for more
information).
else
AF = 0
CF = 0
in both cases:
clear the high nibble of AL.
Example:
MOV AX, 15 ; AH = 00, AL = 0Fh
AAA ; AH = 01, AL = 05
RET
C ZSOPA
r ? ? ? ? r
Algorithm:
AL = (AH * 10) + AL
AH = 0
AAD No operands
Example:
MOV AX, 0105h ; AH = 01, AL = 05
AAD ; AH = 00, AL = 0Fh (15)
RET
C ZSOPA
? r r ? r ?
Algorithm:
AH = AL / 10
AL = remainder
Example:
Algorithm:
else
AAS No operands AF = 0
CF = 0
in both cases:
clear the high nibble of AL.
Example:
MOV AX, 02FFh ; AH = 02, AL = 0FFh
AAS ; AH = 01, AL = 09
RET
C ZSOPA
r ? ? ? ? r
Add.
REG, Algorithm:
memory
memory, operand1 = operand1 + operand2
REG
ADD REG, REG Example:
memory, MOV AL, 5 ; AL = 5
immediate ADD AL, -3 ; AL = 2
REG, RET
immediate C ZSOPA
r r r r r r
REG, 1 AND 1 = 1
memory 1 AND 0 = 0
memory, 0 AND 1 = 0
REG 0 AND 0 = 0
AND REG, REG
memory,
immediate Example:
REG, MOV AL, 'a' ; AL = 01100001b
immediate AND AL, 11011111b ; AL = 01000001b ('A')
RET
C ZSOP
0 r r 0 r
Example:
CALL p1
ADD AX, 1
Algorithm:
else
AH = 0
CBW No operands
Example:
MOV AX, 0 ; AH = 0, AL = 0
MOV AL, -5 ; AX = 000FBh (251)
CBW ; AX = 0FFFBh (-5)
RET
C ZSOPA
unchanged
CF = 0
CLC No operands
C
0
Algorithm:
CLD No operands
DF = 0
D
0
Algorithm:
CLI No operands IF = 0
I
0
if CF = 1 then CF = 0
if CF = 0 then CF = 1
CMC No operands
C
r
Algorithm:
DS:[SI] - ES:[DI]
set flags according to result:
OF, SF, ZF, AF, PF, CF
if DF = 0 then
o SI = SI + 1
o DI = DI + 1
o SI = SI - 1
o DI = DI - 1
Example:
open cmpsb.asm from c:\emu8086\examples
C ZSOPA
r r r r r r
Algorithm:
DS:[SI] - ES:[DI]
set flags according to result:
OF, SF, ZF, AF, PF, CF
if DF = 0 then
o SI = SI + 2
o DI = DI + 2
else
o SI = SI - 2
o DI = DI - 2
C ZSOPA
r r r r r r
else
DX = 0
CWD No operands
Example:
MOV DX, 0 ; DX = 0
MOV AX, 0 ; AX = 0
MOV AX, -5 ; DX AX = 00000h:0FFFBh
CWD ; DX AX = 0FFFFh:0FFFBh
RET
C ZSOPA
unchanged
Algorithm:
DAA No operands
if AL > 9Fh or CF = 1 then:
AL = AL + 60h
CF = 1
Example:
MOV AL, 0Fh ; AL = 0Fh (15)
DAA ; AL = 15h
RET
Algorithm:
Example:
MOV AL, 0FFh ; AL = 0FFh (-1)
DAS ; AL = 99h, CF = 1
RET
C ZSOPA
r r r r r r
Decrement.
Algorithm:
operand = operand - 1
REG
DEC memory Example:
MOV AL, 255 ; AL = 0FFh (255 or -1)
DEC AL ; AL = 0FEh (254 or -2)
RET
Z SOPA
r r r r r
CF - unchanged!
Example:
MOV AX, 203 ; AX = 00CBh
MOV BL, 4
DIV BL ; AL = 50 (32h), AH = 3
RET
C ZSOPA
? ? ? ? ? ?
Signed divide.
Algorithm:
Example:
MOV AX, -203 ; AX = 0FF35h
MOV BL, 4
IDIV BL ; AL = -50 (0CEh), AH = -3 (0FDh)
RET
C ZSOPA
? ? ? ? ? ?
Increment.
Algorithm:
operand = operand + 1
REG Example:
INC memory MOV AL, 4
INC AL ; AL = 5
RET
Z SOPA
r r r r r
CF - unchanged!
Push to stack:
o flags register
o CS
o IP
IF = 0
Transfer control to interrupt procedure
byte
Example:
MOV AH, 0Eh ; teletype.
MOV AL, 'A'
INT 10h ; BIOS interrupt.
RET
C ZSOPAI
unchanged 0
if OF = 1 then INT 4
Example:
INTO No operands ; -5 - 127 = -132 (not in -128..127)
; the result of SUB is wrong (124),
; so OF = 1 is set:
MOV AL, -5
SUB AL, 127 ; AL = 7Ch (124)
INTO ; process error.
RET
Interrupt Return.
Algorithm:
C ZSOPA
popped
Algorithm:
Algorithm:
if CF = 0 then jump
Example:
include 'emu8086.inc'
ORG 100h
MOV AL, 5
CMP AL, 5
JAE label
JAE label1
PRINT 'AL is not above or equal to 5'
JMP exit
label1:
PRINT 'AL is above or equal to 5'
exit:
RET
C ZSOPA
unchanged
JB label Short Jump if first operand is Below second operand (as set
by CMP instruction). Unsigned.
if CF = 1 then jump
Example:
include 'emu8086.inc'
ORG 100h
MOV AL, 1
CMP AL, 5
JB label1
PRINT 'AL is not below 5'
JMP exit
label1:
PRINT 'AL is below 5'
exit:
RET
C ZSOPA
unchanged
Algorithm:
if CF = 1 or ZF = 1 then jump
Example:
include 'emu8086.inc'
ORG 100h
MOV AL, 5
CMP AL, 5
JBE label
JBE label1
PRINT 'AL is not below or equal to 5'
JMP exit
label1:
PRINT 'AL is below or equal to 5'
exit:
RET
C ZSOPA
unchanged
Algorithm:
if CF = 1 then jump
Example:
Algorithm:
if CX = 0 then jump
Example:
include 'emu8086.inc'
ORG 100h
MOV CX, 0
JCXZ label1
JCXZ label
PRINT 'CX is not zero.'
JMP exit
label1:
PRINT 'CX is zero.'
exit:
RET
C ZSOPA
unchanged
Algorithm:
if ZF = 1 then jump
Example:
include 'emu8086.inc'
ORG 100h
MOV AL, 5
CMP AL, 5
JE label1
Algorithm:
Algorithm:
if SF = OF then jump
Example:
include 'emu8086.inc'
ORG 100h
MOV AL, 2
CMP AL, -5
JGE label1
PRINT 'AL < -5'
JMP exit
label1:
Algorithm:
Algorithm:
Algorithm:
always jump
Example:
label
include 'emu8086.inc'
4-byte
JMP ORG 100h
address
MOV AL, 5
JMP label1 ; jump over 2 lines!
PRINT 'Not Jumped!'
MOV AL, 0
label1:
PRINT 'Got Here!'
RET
C ZSOPA
unchanged
Algorithm:
if CF = 1 or ZF = 1 then jump
Example:
include 'emu8086.inc'
Algorithm:
if CF = 1 then jump
Example:
include 'emu8086.inc'
ORG 100h
MOV AL, 2
JNAE label
CMP AL, 5
JNAE label1
PRINT 'AL >= 5.'
JMP exit
label1:
PRINT 'AL < 5.'
exit:
RET
C ZSOPA
unchanged
Algorithm:
if CF = 0 then jump
Example:
include 'emu8086.inc'
Algorithm:
ORG 100h
MOV AL, 7
JNBE label
CMP AL, 5
JNBE label1
PRINT 'AL <= 5.'
JMP exit
label1:
PRINT 'AL > 5.'
exit:
RET
C ZSOPA
unchanged
Algorithm:
if CF = 0 then jump
Example:
include 'emu8086.inc'
ORG 100h
JNC label MOV AL, 2
ADD AL, 3
JNC label1
PRINT 'has carry.'
JMP exit
label1:
PRINT 'no carry.'
exit:
RET
Algorithm:
if ZF = 0 then jump
Example:
include 'emu8086.inc'
ORG 100h
MOV AL, 2
JNE label
CMP AL, 3
JNE label1
PRINT 'AL = 3.'
JMP exit
label1:
PRINT 'Al <> 3.'
exit:
RET
C ZSOPA
unchanged
Algorithm:
Algorithm:
ORG 100h
MOV AL, 2
JNGE label
CMP AL, 3
JNGE label1
PRINT 'AL >= 3.'
JMP exit
label1:
PRINT 'Al < 3.'
exit:
RET
C ZSOPA
unchanged
Algorithm:
if SF = OF then jump
Example:
include 'emu8086.inc'
Algorithm:
ORG 100h
MOV AL, 2
JNLE label
CMP AL, -3
JNLE label1
PRINT 'AL <= -3.'
JMP exit
label1:
PRINT 'Al > -3.'
exit:
RET
C ZSOPA
unchanged
Algorithm:
if OF = 0 then jump
Example:
; -5 - 2 = -7 (inside -128..127)
; the result of SUB is correct,
; so OF = 0:
include 'emu8086.inc'
ORG 100h
MOV AL, -5
SUB AL, 2 ; AL = 0F9h (-7)
JNO label1
PRINT 'overflow!'
JMP exit
label1:
Algorithm:
if PF = 0 then jump
Example:
include 'emu8086.inc'
ORG 100h
MOV AL, 00000111b ; AL = 7
JNP label
OR AL, 0 ; just set flags.
JNP label1
PRINT 'parity even.'
JMP exit
label1:
PRINT 'parity odd.'
exit:
RET
C ZSOPA
unchanged
JNS label Short Jump if Not Signed (if positive). Set by CMP, SUB,
ADD, TEST, AND, OR, XOR instructions.
Algorithm:
if SF = 0 then jump
Example:
include 'emu8086.inc'
ORG 100h
MOV AL, 00000111b ; AL = 7
OR AL, 0 ; just set flags.
JNS label1
PRINT 'signed.'
JMP exit
label1:
Algorithm:
if ZF = 0 then jump
Example:
include 'emu8086.inc'
ORG 100h
MOV AL, 00000111b ; AL = 7
JNZ label OR AL, 0 ; just set flags.
JNZ label1
PRINT 'zero.'
JMP exit
label1:
PRINT 'not zero.'
exit:
RET
C ZSOPA
unchanged
Algorithm:
if OF = 1 then jump
Example:
; -5 - 127 = -132 (not in -128..127)
; the result of SUB is wrong (124),
; so OF = 1 is set:
include 'emu8086.inc'
org 100h
MOV AL, -5
SUB AL, 127 ; AL = 7Ch (124)
JO label1
PRINT 'no overflow.'
Algorithm:
if PF = 1 then jump
Example:
include 'emu8086.inc'
ORG 100h
MOV AL, 00000101b ; AL = 5
JP label
OR AL, 0 ; just set flags.
JP label1
PRINT 'parity odd.'
JMP exit
label1:
PRINT 'parity even.'
exit:
RET
C ZSOPA
unchanged
JPE label Short Jump if Parity Even. Only 8 low bits of result are
checked. Set by CMP, SUB, ADD, TEST, AND, OR, XOR
instructions.
Algorithm:
if PF = 1 then jump
Example:
include 'emu8086.inc'
ORG 100h
MOV AL, 00000101b ; AL = 5
OR AL, 0 ; just set flags.
JPE label1
Algorithm:
if PF = 0 then jump
Example:
include 'emu8086.inc'
ORG 100h
MOV AL, 00000111b ; AL = 7
JPO label
OR AL, 0 ; just set flags.
JPO label1
PRINT 'parity even.'
JMP exit
label1:
PRINT 'parity odd.'
exit:
RET
C ZSOPA
unchanged
Algorithm:
if SF = 1 then jump
Example:
include 'emu8086.inc'
ORG 100h
MOV AL, 10000000b ; AL = -128
OR AL, 0 ; just set flags.
JS label1
Algorithm:
if ZF = 1 then jump
Example:
include 'emu8086.inc'
ORG 100h
MOV AL, 5
JZ label CMP AL, 5
JZ label1
PRINT 'AL is not equal to 5.'
JMP exit
label1:
PRINT 'AL is equal to 5.'
exit:
RET
C ZSOPA
unchanged
AH = flags register
AH bit: 7 6 5 4 3 2 1 0
LAHF No operands [SF] [ZF] [0] [AF] [0] [PF] [1] [CF]
bits 1, 3, 5 are reserved.
C ZSOPA
unchanged
Example:
ORG 100h
m DW 1234h
DW 5678h
END
C ZSOPA
unchanged
Example:
ORG 100h
LEA AX, m
RET
m DW 1234h
C ZSOPA
unchanged
Algorithm:
Example:
ORG 100h
m DW 1234h
DW 5678h
END
C ZSOPA
unchanged
Algorithm:
AL = DS:[SI]
if DF = 0 then
o SI = SI + 1
o SI = SI - 1
Example:
ORG 100h
LEA SI, a1
MOV CX, 5
MOV AH, 0Eh
m: LODSB
INT 10h
LOOP m
RET
Algorithm:
AX = DS:[SI]
if DF = 0 then
o SI = SI + 2
else
o SI = SI - 2
Example:
ORG 100h
LEA SI, a1
MOV CX, 5
RET
CX = CX - 1
if CX <> 0 then
o jump
else
o no jump, continue
ORG 100h
MOV CX, 5
label1:
PRINTN 'loop!'
LOOP label1
RET
C ZSOPA
unchanged
LOOPE label Decrease CX, jump to label if CX not zero and Equal (ZF =
1).
Algorithm:
CX = CX - 1
if (CX <> 0) and (ZF = 1) then
o jump
else
o no jump, continue
Example:
; Loop until result fits into AL alone,
; or 5 times. The result will be over 255
; on third loop (100+100+100),
include 'emu8086.inc'
ORG 100h
MOV AX, 0
MOV CX, 5
label1:
PUTC '*'
ADD AX, 100
CMP AH, 0
LOOPE label1
RET
C ZSOPA
unchanged
Algorithm:
CX = CX - 1
if (CX <> 0) and (ZF = 0) then
o jump
else
o no jump, continue
Example:
; Loop until '7' is found,
LOOPNE label
; or 5 times.
include 'emu8086.inc'
ORG 100h
MOV SI, 0
MOV CX, 5
label1:
PUTC '*'
MOV AL, v1[SI]
INC SI ; next byte (SI=SI+1).
CMP AL, 7
LOOPNE label1
RET
v1 db 9, 8, 7, 6, 5
Algorithm:
CX = CX - 1
if (CX <> 0) and (ZF = 0) then
o jump
else
o no jump, continue
Example:
; Loop until '7' is found,
; or 5 times.
ORG 100h
MOV SI, 0
MOV CX, 5
label1:
PUTC '*'
MOV AL, v1[SI]
INC SI ; next byte (SI=SI+1).
CMP AL, 7
LOOPNZ label1
RET
v1 db 9, 8, 7, 6, 5
C ZSOPA
unchanged
Algorithm:
CX = CX - 1
if (CX <> 0) and (ZF = 1) then
o jump
o no jump, continue
Example:
; Loop until result fits into AL alone,
; or 5 times. The result will be over 255
; on third loop (100+100+100),
; so loop will exit.
include 'emu8086.inc'
ORG 100h
MOV AX, 0
MOV CX, 5
label1:
PUTC '*'
ADD AX, 100
CMP AH, 0
LOOPZ label1
RET
C ZSOPA
unchanged
SREG,
memory Algorithm:
memory,
SREG operand1 = operand2
REG, SREG
SREG, REG Example:
ORG 100h
MOV AX, 0B800h ; set AX = B800h (VGA memory).
MOV DS, AX ; copy value of AX to DS.
MOV CL, 'A' ; CL = 41h (ASCII code).
Algorithm:
ES:[DI] = DS:[SI]
if DF = 0 then
o SI = SI + 1
o DI = DI + 1
else
o SI = SI - 1
o DI = DI - 1
Example:
MOVSB No operands
ORG 100h
CLD
LEA SI, a1
LEA DI, a2
MOV CX, 5
REP MOVSB
RET
a1 DB 1,2,3,4,5
a2 DB 5 DUP(0)
C ZSOPA
unchanged
Algorithm:
ES:[DI] = DS:[SI]
if DF = 0 then
o SI = SI + 2
else
o SI = SI - 2
o DI = DI - 2
Example:
ORG 100h
CLD
LEA SI, a1
LEA DI, a2
MOV CX, 5
REP MOVSW
RET
a1 DW 1,2,3,4,5
a2 DW 5 DUP(0)
C ZSOPA
unchanged
Unsigned multiply.
Algorithm:
Example:
MOV AL, 5 ; AL = 05h
NEG AL ; AL = 0FBh (-5)
NEG AL ; AL = 05h (5)
RET
C ZSOPA
r r r r r r
No Operation.
Algorithm:
Do nothing
Example:
; do nothing, 3 times:
NOP No operands
NOP
NOP
NOP
RET
C ZSOPA
unchanged
if bit is 1 turn it to 0.
if bit is 0 turn it to 1.
REG
NOT memory Example:
MOV AL, 00011011b
NOT AL ; AL = 11100100b
RET
C ZSOPA
unchanged
1 OR 1 = 1
memory 1 OR 0 = 1
memory, 0 OR 1 = 1
REG 0 OR 0 = 0
REG, REG
memory,
immediate Example:
REG, MOV AL, 'A' ; AL = 01000001b
immediate OR AL, 00100000b ; AL = 01100001b ('a')
RET
C ZSOPA
0 r r 0 r ?
REG
POP SREG Example:
memory MOV AX, 1234h
PUSH AX
POP DX ; DX = 1234h
RET
C ZSOPA
unchanged
Algorithm:
POP DI
POP SI
POPA No operands POP BP
POP xx (SP value ignored)
POP BX
POP DX
POP CX
POP AX
C ZSOPA
unchanged
C ZSOPA
popped
Algorithm:
SP = SP - 2
SS:[SP] (top of the stack) = operand
Example:
MOV AX, 1234h
PUSH AX
POP DX ; DX = 1234h
Push all general purpose registers AX, CX, DX, BX, SP,
BP, SI, DI in the stack.
Original value of SP register (before PUSHA) is used.
Algorithm:
PUSH AX
PUSH CX
PUSHA No operands
PUSH DX
PUSH BX
PUSH SP
PUSH BP
PUSH SI
PUSH DI
C ZSOPA
unchanged
SP = SP - 2
PUSHF No operands SS:[SP] (top of the stack) = flags
C ZSOPA
unchanged
RCL memory, Rotate operand1 left through Carry Flag. The number of
immediate rotates is set by operand2.
REG, When immediate is greater then 1, assembler generates
immediate several RCL xx, 1 instructions because 8086 has machine
code only for this instruction (the same principle works for
memory, CL all other shift/rotate instructions).
REG, CL
shift all bits left, the bit that goes off is set to CF and
previous value of CF is inserted to the right-most
position.
Example:
STC ; set carry (CF=1).
MOV AL, 1Ch ; AL = 00011100b
RCL AL, 1 ; AL = 00111001b, CF=0.
RET
C O
r r
OF=0 if first operand keeps original sign.
Algorithm:
shift all bits right, the bit that goes off is set to CF
memory,
and previous value of CF is inserted to the left-most
immediate
position.
REG,
RCR immediate
Example:
STC ; set carry (CF=1).
memory, CL
MOV AL, 1Ch ; AL = 00011100b
REG, CL
RCR AL, 1 ; AL = 10001110b, CF=0.
RET
C O
r r
OF=0 if first operand keeps original sign.
Algorithm:
check_cx:
if CX <> 0 then
do following chain instruction
CX = CX - 1
go back to check_cx
else
Z
r
Algorithm:
check_cx:
if CX <> 0 then
do following chain instruction
CX = CX - 1
if ZF = 1 then:
o go back to check_cx
chain
REPE
instruction else
else
exit from REPE cycle
example:
open cmpsb.asm from c:\emu8086\examples
Z
r
Algorithm:
check_cx:
if CX <> 0 then
do following chain instruction
CX = CX - 1
if ZF = 0 then:
else
else
exit from REPNE cycle
Z
r
Algorithm:
check_cx:
if CX <> 0 then
do following chain instruction
CX = CX - 1
if ZF = 0 then:
chain
REPNZ o go back to check_cx
instruction
else
else
exit from REPNZ cycle
Z
r
Algorithm:
check_cx:
else
else
exit from REPZ cycle
Z
r
Algorithm:
Example:
C ZSOPA
unchanged
Algorithm:
memory,
immediate shift all bits left, the bit that goes off is set to CF and
REG, the same bit is inserted to the right-most position.
ROL immediate Example:
MOV AL, 1Ch ; AL = 00011100b
memory, CL ROL AL, 1 ; AL = 00111000b, CF=0.
REG, CL RET
C O
r r
OF=0 if first operand keeps original sign.
Algorithm:
memory,
immediate shift all bits right, the bit that goes off is set to CF
REG, and the same bit is inserted to the left-most position.
ROR immediate Example:
MOV AL, 1Ch ; AL = 00011100b
memory, CL ROR AL, 1 ; AL = 00001110b, CF=0.
REG, CL RET
C O
r r
OF=0 if first operand keeps original sign.
Algorithm:
flags register = AH
C ZSOPA
r r r r r r
Algorithm:
memory,
Shift all bits left, the bit that goes off is set to CF.
immediate
Zero bit is inserted to the right-most position.
REG,
SAL immediate
Example:
MOV AL, 0E0h ; AL = 11100000b
memory, CL
SAL AL, 1 ; AL = 11000000b, CF=1.
REG, CL
RET
C O
r r
OF=0 if first operand keeps original sign.
Algorithm:
Shift all bits right, the bit that goes off is set to CF.
The sign bit that is inserted to the left-most position
memory, has the same value as before shift.
immediate
REG, Example:
SAR immediate MOV AL, 0E0h ; AL = 11100000b
SAR AL, 1 ; AL = 11110000b, CF=0.
memory, CL
REG, CL MOV BL, 4Ch ; BL = 01001100b
SAR BL, 1 ; BL = 00100110b, CF=0.
RET
C O
r r
OF=0 if first operand keeps original sign.
Algorithm:
ES:[DI] - AL
set flags according to result:
OF, SF, ZF, AF, PF, CF
if DF = 0 then
o DI = DI + 1
SCASB No operands
else
o DI = DI - 1
C ZSOPA
r r r r r r
Algorithm:
ES:[DI] - AX
set flags according to result:
OF, SF, ZF, AF, PF, CF
if DF = 0 then
o DI = DI + 2
else
C ZSOPA
r r r r r r
Algorithm:
memory, Shift all bits left, the bit that goes off is set to CF.
immediate Zero bit is inserted to the right-most position.
REG,
SHL immediate Example:
MOV AL, 11100000b
memory, CL SHL AL, 1 ; AL = 11000000b, CF=1.
REG, CL
RET
C O
r r
OF=0 if first operand keeps original sign.
Algorithm:
memory, Shift all bits right, the bit that goes off is set to CF.
immediate Zero bit is inserted to the left-most position.
REG,
SHR immediate Example:
MOV AL, 00000111b
memory, CL SHR AL, 1 ; AL = 00000011b, CF=1.
REG, CL
RET
C O
r r
OF=0 if first operand keeps original sign.
Algorithm:
C
1
Algorithm:
STD No operands
DF = 1
D
1
Algorithm:
STI No operands IF = 1
I
1
Algorithm:
ES:[DI] = AL
if DF = 0 then
o DI = DI + 1
else
o DI = DI - 1
Example:
ORG 100h
LEA DI, a1
REP STOSB
RET
a1 DB 5 dup(0)
C ZSOPA
unchanged
Algorithm:
ES:[DI] = AX
if DF = 0 then
o DI = DI + 2
else
o DI = DI - 2
Example:
LEA DI, a1
MOV AX, 1234h
MOV CX, 5
REP STOSW
RET
a1 DW 5 dup(0)
C ZSOPA
unchanged
REG, Example:
memory MOV AL, 5
XCHG memory, MOV AH, 2
REG XCHG AL, AH ; AL = 2, AH = 5
REG, REG XCHG AL, AH ; AL = 5, AH = 2
RET
C ZSOPA
unchanged
Algorithm:
Example:
ORG 100h
XLATB No operands
LEA BX, dat
MOV AL, 2
XLATB ; AL = 33h
RET
REG, 1 XOR 1 = 0
memory 1 XOR 0 = 1
memory, 0 XOR 1 = 1
REG 0 XOR 0 = 0
XOR REG, REG
memory,
immediate Example:
REG, MOV AL, 00000111b
immediate XOR AL, 00000010b ; AL = 00000101b
RET
C ZSOPA
0 r r 0 r ?